From nobody Thu Feb 12 23:04:45 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 264A01A23BE for ; Thu, 2 Jan 2025 15:19:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1735831172; cv=none; b=IkJxSA0JFJO/mUazcVj9ZuDkaUZrSMryXvfNk0fPWvU4np4hRuo7KH/g28EJf8hLy2blR3J/Z2YgmTaFlSAVkvq2UKKk8q1jHDfA/MAjHsj3E43CHGHQGJu1WB26TKeT/JyNwFS0tD841jj0oJtQU9A6e+lYprE+2SsgRSSOjzA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1735831172; c=relaxed/simple; bh=veMdH/h5MOtLPZq9Xq4E9nfWL5SzFQlU9S11f3+xgA0=; h=Date:From:To:Cc:Subject:Message-ID:MIME-Version:Content-Type; b=GkY5LU727ni3iJCHSiNZTBbMeRFebD81yoMfVz0gunLTTUxFZ8zihpTbXm7qRIKRl8JV7AJ/kCLyJnT658OrRv/L1WZstyu9fkQ2spwzHOL5b+CpkoLztkFMD2Ix9LtFhjOpy75IXP6oJEZ0zbHqlkodJxnteA3p/jxRNOPLQ60= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 Received: by smtp.kernel.org (Postfix) with ESMTPSA id C39F7C4CED0; Thu, 2 Jan 2025 15:19:30 +0000 (UTC) Date: Thu, 2 Jan 2025 10:20:46 -0500 From: Steven Rostedt To: Linus Torvalds Cc: LKML , Masami Hiramatsu , Mathieu Desnoyers , Mark Rutland , Zilin Guan Subject: [GIT PULL] ftrace: Fix for v6.13 Message-ID: <20250102102046.27a467a9@gandalf.local.home> X-Mailer: Claws Mail 3.20.0git84 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Linus, Fix for function graph tracer in v6.13: - Add needed READ_ONCE() around access to the fgraph array element The updates to the fgraph array can happen when callbacks are registered and deregistered. The __ftrace_return_to_handler() can handle reading either the old value or the new value. But once it reads that value it must stay consistent otherwise the check that looks to see if the value is a stub may show false, but if the compiler decides to re-read after that check, it can be true which can cause the code to crash later on. Please pull the latest ftrace-v6.13-rc5 tree, which can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git ftrace-v6.13-rc5 Tag SHA1: 0ba23030ff298e46f7d435ee1e11040d00239871 Head SHA1: e99b3d0cb6cd0b051fea113bb9a4088d595c4693 Zilin Guan (1): fgraph: Add READ_ONCE() when accessing fgraph_array[] ---- kernel/trace/fgraph.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --------------------------- commit e99b3d0cb6cd0b051fea113bb9a4088d595c4693 Author: Zilin Guan Date: Tue Dec 31 11:37:31 2024 +0000 fgraph: Add READ_ONCE() when accessing fgraph_array[] =20 In __ftrace_return_to_handler(), a loop iterates over the fgraph_array[] elements, which are fgraph_ops. The loop checks if an element is a fgraph_stub to prevent using a fgraph_stub afterward. =20 However, if the compiler reloads fgraph_array[] after this check, it mi= ght race with an update to fgraph_array[] that introduces a fgraph_stub. Th= is could result in the stub being processed, but the stub contains a null "func_hash" field, leading to a NULL pointer dereference. =20 To ensure that the gops compared against the fgraph_stub matches the go= ps processed later, add a READ_ONCE(). A similar patch appears in commit 63a8dfb ("function_graph: Add READ_ONCE() when accessing fgraph_array[]= "). =20 Cc:stable@vger.kernel.org Fixes: 37238abe3cb47 ("ftrace/function_graph: Pass fgraph_ops to functi= on graph callbacks") Link: https://lore.kernel.org/20241231113731.277668-1-zilin@seu.edu.cn Signed-off-by: Zilin Guan Signed-off-by: Steven Rostedt (Google) diff --git a/kernel/trace/fgraph.c b/kernel/trace/fgraph.c index ddedcb50917f..30e3ddc8a8a8 100644 --- a/kernel/trace/fgraph.c +++ b/kernel/trace/fgraph.c @@ -833,7 +833,7 @@ static unsigned long __ftrace_return_to_handler(struct = fgraph_ret_regs *ret_regs #endif { for_each_set_bit(i, &bitmap, sizeof(bitmap) * BITS_PER_BYTE) { - struct fgraph_ops *gops =3D fgraph_array[i]; + struct fgraph_ops *gops =3D READ_ONCE(fgraph_array[i]); =20 if (gops =3D=3D &fgraph_stub) continue;